Verify Signature

This API endpoint allows you to verify the integrity of a signature by comparing it to a message hash using the specified credential ID and presence key (silent key or presence key). The response returns a success status if the signature matches the message hash.

API Description

API to verify signature

POST https://{{environment_url}}/api/v1/device/verify

Headers

Name	Type	Description
Content-Type*		Format type of request body Value : application/json
accept*	String	*/*
Authorization*	String	Bearer <Token>

Request Body

Name	Type	Description
credential_id*	String	registered credential id
presence*	String	SILENT_USER - Check with silent key ENFORCE_USER_PRESENCE - Check with presence key
message_hash*	String	Hash of the message that has been signed
signed_data*	String	Signature of message hash

API Response

Verify Signature Request Successful

If the signature derived from the hash of the message matches, success is returned in as status in response.

HTTP Status Code: 200

JSON Response

{
    "status": "success"
}

Integration Code Snippets

Curl

curl -X 'POST' \
'http://{{environment_url}}/api/v1/device/verify'\
-H 'accept: */*' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <bearer token>' \
-d '{
"credential_id": "bbdcfd28-0e58-11ed-861d-0242ac120002",
"presence": "SILENT_USER",
"message_hash" : "test",
"signed_data" : "MEUCIGkP8ccfLee"
}'

Signature verification at the partner server

The public keys from VIDA API can be obtained with the call fetch-public-key. This endpoint will return keys in base64 format. X509EncodedKeySpec must be used to create a PublicKey structure.

JAVA

public static PublicKey generatePublicKeyFromString(String keyValue) {
    try {
        final EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(keyValue));
        final KeyFactory keyFactory = KeyFactory.getInstance("EC");
        return keyFactory.generatePublic(publicKeySpec);
    } catch (NoSuchAlgorithmException |
        InvalidKeySpecException IllegalArgumentException e) 
        {
        throw new BusinessException(format("Could not generate PublicKey for: %s", keyValue), e);
}

If the key generation succeeds, we can verify the signature and message hash with the PublicKey instance. The messageHash should not have encapsulating whitespaces.

JAVA

public static boolean validateSignature(
PublicKey publicKey,
String signature,
String messageHash) {
    try {
        final Signature ecdsaVerify = Signature.getInstance("SHA256withECDSA");
        ecdsaVerify.initVerify(publicKey);
        ecdsaVerify.update(messageHash.getBytes(UTF_8));
        return ecdsaVerify.verify(Base64.getDecoder().decode(signature));
    } catch (NoSuchAlgorithmException | SignatureException |
        InvalidKeyException |
        IllegalArgumentException e) 
        {
            throw new BusinessException("Could not validate signature", e);
        }
}